01_pwnbox/htb-create-env.sh
#!/bin/bash

# Check args 
if [ ! $# -eq 2 ]
then
    echo "[-] Usage: $0 <NAME> <IP> (e.g.: '$0 Control 10.10.10.167')"
    exit
fi

IFS=$'\n'

# $1 = Machine name (TARGET_NAME)
# $2 = IP address  (TARGET_IP)
TARGET_NAME=$1
TARGET_IP=$2
HTB_DIR_BOX="$HOME/HTB/$TARGET_NAME"
HTB_DIR_BOX_NMAP="$HTB_DIR_BOX/nmap"
HTB_DIR_BOX_WEB="$HTB_DIR_BOX/web"
HTB_DIR_BOX_WWW="$HTB_DIR_BOX/www"
HTB_DIR_BOX_LOOT="$HTB_DIR_BOX/loot"
HTB_DIR_BOX_NOTES="$HTB_DIR_BOX/notes.md"

echo "[*] Creating folders..."
mkdir -p $HTB_DIR_BOX_NMAP
mkdir -p $HTB_DIR_BOX_WEB
mkdir -p $HTB_DIR_BOX_WWW
mkdir -p $HTB_DIR_BOX_LOOT

echo "[*] Writing note file..."

cat > $HTB_DIR_BOX_NOTES <<-EOF
# $TARGET_NAME 

## Info 

Target 
\`\`\`txt
IP: $TARGET_IP
\`\`\`

Creds
\`\`\`txt

\`\`\`

Flags
\`\`\`txt
user.txt - 
root.txt - 
\`\`\`


## Recon 

Nmap 
\`\`\`sh
nmap -vvv -sVC -Pn -O -n -sT --reason --open -p- -oA ./nmap/tcp_$TARGET_IP $TARGET_IP
nmap -sU -n --top-ports 50 --open --reason -vvv -sVC -oA ./nmap/udp_$TARGET_IP $TARGET_IP
\`\`\`

Result
\`\`\`txt

\`\`\`


## Web

dirsearch
\`\`\`sh
# HTTP
dirsearch.py -E -w /usr/share/dirb/wordlists/common.txt --plain-text-report ./web-recon/dirsearch_common_$TARGET_IP.txt -u http://$TARGET_IP/
dirsearch.py -E -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt --plain-text-report ./web-recon/dirsearch_medium_$TARGET_IP.txt -u http://$TARGET_IP/
# HTTPS
dirsearch.py -E -w /usr/share/dirb/wordlists/common.txt --plain-text-report ./web-recon/dirsearch_common_$TARGET_IP.txt -u https://$TARGET_IP/
dirsearch.py -E -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt --plain-text-report ./web-recon/dirsearch_medium_TARGET.txt -u https://$TARGET_IP/
\`\`\`

Result
\`\`\`txt

\`\`\`


## SMB

\`\`\`sh
enum4linux -a $TARGET_IP 
nmblookup -A $TARGET_IP
smbmap -H $TARGET_IP
nbtscan $TARGET_IP 
smbclient -L $TARGET_IP
cme smb $TARGET_IP
cme smb $TARGET_IP -u '' -p '' --local-auth
\`\`\`

Result
\`\`\`txt

\`\`\`

EOF